CompTIA Security+ Practice Test & Study Material

→ Why the correct answer is right:

When using third-party cloud vendors, organizations must consider where data is stored and who can access it. Data sovereignty and access control gaps can lead to compliance and security issues. This is a core vendor risk management concern.

→ Why the other options are wrong:

Option B: Integration capabilities matter for functionality, not primarily security.

Option C: Cost of services is a business consideration, not the primary security concern.

Option D: Scalability relates to growth capacity, not data protection or access risk.

Exam Tip 🧠

"Cloud Vendors = Watch Data Location and Access"

→ Why the correct answer is right:

Data in use is actively being processed, accessed, or read by an application or user. It requires protections like memory encryption since it's briefly unencrypted during processing. This is one of the three core data states.

→ Why the other options are wrong:

Option A: Data at rest is stored data, not actively being processed.

Option B: Data in transit is actively moving across a network, not being processed locally.

Option C: Geolocation refers to physical location tracking, not a data processing state.

Exam Tip 🧠

"Data in Use = Actively Being Processed"

→ Why the correct answer is right:

A UPS provides immediate short-term power, while a generator sustains operations during extended outages. Together they cover the full range of power failure scenarios. This combination ensures continuous operation without downtime.

→ Why the other options are wrong:

Option A: Power converters change power form but don't provide backup power like a UPS does.

Option C: Power regulators and converters stabilize power but don't provide continuous backup power over time.

Option D: Power stabilizers alone don't provide the long-term backup a generator offers.

Exam Tip 🧠

"UPS + Generator = Short-Term + Long-Term Power"

→ Why the correct answer is right:

Inline devices sit directly in the traffic path and can intervene in real time. Tap/monitor mode devices only see a copied stream and cannot act on live traffic. This positioning difference defines their capabilities.

→ Why the other options are wrong:

Option A: Being "always active" isn't precisely what separates the two; it's about physical placement in the traffic path.

Option B: While often true, this describes behavior rather than the defining structural placement difference asked here.

Option C: Power requirements aren't the defining distinction between inline and tap/monitor modes.

Exam Tip 🧠

"Inline = In the Path, Tap = Watching a Copy"

→ Why the correct answer is right:

Cost considerations evaluate both initial and ongoing financial implications of deploying and maintaining a system. This helps organizations budget appropriately. It's a key factor in any technology decision.

→ Why the other options are wrong:

Option B: Risk transference involves shifting risk responsibility, not directly about deployment costs.

Option C: Patch availability concerns whether updates exist, not financial impact.

Option D: Scalability concerns growth capacity, not the financial implications specifically.

Exam Tip 🧠

"Cost = Financial Impact of the Decision"

→ Why the correct answer is right:

Centralized systems have a single point of control, while decentralized systems distribute control across multiple nodes. This affects resilience, since decentralized systems avoid single points of failure. It's a fundamental architectural distinction.

→ Why the other options are wrong:

Option A: Virtualization is a technology choice, not what defines centralized versus decentralized control.

Option C: Physical server location doesn't define the control distribution model.

Option D: Reliance on cloud resources is a deployment choice, not the defining difference here.

Exam Tip 🧠

"Centralized = One Boss, Decentralized = Many Nodes"

→ Why the correct answer is right:

Effective security controls must align with the specific risks and threats an organization faces. Controls chosen without this alignment may waste resources or leave gaps. Risk-based selection ensures relevance and effectiveness.

→ Why the other options are wrong:

Option A: The vendor doesn't determine whether a control addresses the actual risks.

Option B: The age of a control doesn't guarantee its relevance to current threats.

Option D: Popularity doesn't ensure a control fits the organization's specific risk profile.

Exam Tip 🧠

"Controls Must Match the Risk"

→ Why the correct answer is right:

ALE = ARO × SLE. ARO = 20% = 0.20 | SLE = $500,000. ALE = 0.20 × $500,000 = $100,000. The organization can expect an average annual loss of $100,000 from this specific risk.

→ Why the other options are wrong:

Option A: $50,000: Reflects a 10% ARO (0.10 × $500,000), not 20%.

Option C: $200,000: Reflects a 40% ARO (0.40 × $500,000), not 20%.

Option D: $500,000: Equals the full SLE — only correct if the attack was 100% certain to happen each year.

Exam Tip 🧠

"ALE = ARO × SLE. How often it happens × how much it costs = Annual expected loss. 20% × $500K = $100K!"

→ Why the correct answer is right:

In DAC, the owner of a resource has full discretion over who can access it and at what level (read, write, execute). Standard Windows and Linux file systems use DAC — when you right-click a file and set permissions, that is DAC in action. The owner decides, not a central policy engine.

→ Why the other options are wrong:

Option A: MAC: System-enforced — the OS security policy makes access decisions. Users cannot override permissions even for their own files. Used in SELinux.

Option B: RBAC: Access is based on a user's organizational role (Manager, Analyst), not individual file ownership.

Option D: Rule-Based Access Control: Uses system-defined rules (time of day, IP range) to control access — not individual owner discretion.

Exam Tip 🧠

"DAC = Discretionary = YOUR CHOICE as the file owner. YOU set who reads your files. MAC = Mandatory = System decides, not you!"

→ Why the correct answer is right:

This script creates a persistent, hidden pathway for attackers. The four smoking guns: Root check → Runs with highest system privileges Downloads from malicious.example.com → Pulls attacker-controlled code Unverified execution → Runs the script blindly with no validation Daily CRON → Re-establishes itself every day even if manually removed

→ Why the other options are wrong:

Option A: Logic Bomb: Triggers under specific conditions (a date or event). This script doesn't wait for a trigger — it runs unconditionally every day.

Option C: Rootkit: Rootkits focus on hiding their presence. The script could deliver a rootkit but the primary vulnerability here is the backdoor mechanism.

Option D: Spam: Refers to unsolicited bulk messages — completely unrelated to this script's behavior.

Exam Tip 🧠

"Backdoor = Secret door left open for attackers. Daily CRON + malicious URL download + root exec = Textbook Backdoor!"

→ Why the correct answer is right:

TLS encrypts the communication channel between a web browser and a web server, protecting sensitive data like login credentials, payment info, and personal details from eavesdropping and tampering. When you see the padlock icon in your browser, TLS is working — it's what turns HTTP into HTTPS.

→ Why the other options are wrong:

Option A: IPSec: Secures IP-level network communications broadly (used in VPNs) — not specifically designed for web browser traffic.

Option C: SSH: Secures remote command-line access to servers — not web browsing sessions.

Option D: HTTP: The foundational web protocol with zero encryption — without TLS, all data is transmitted in plain text.

Exam Tip 🧠

"HTTP + TLS = HTTPS = Padlock in browser = Safe! TLS wraps your web data in an encrypted tunnel!"

→ Why the correct answer is right:

A False Positive occurs when the IPS incorrectly flags legitimate activity as a threat. The backup traffic from 10.0.0.52 was completely normal — but the IPS raised an alarm anyway. Emily's investigation confirmed no attack occurred. The system cried wolf — a classic False Positive.

→ Why the other options are wrong:

Option A: True Positive: The system correctly detected a real attack. Here, there was no attack — just backup traffic.

Option B: True Negative: The system correctly identified no threat and stayed silent. Here, the system did fire an alert (incorrectly), so this doesn't apply.

Option D: False Negative: A real attack went undetected. No attack happened here at all.

Exam Tip 🧠

"FP = False Alarm (no fire, alarm rings). FN = Missed Attack (fire, no alarm). TP = Caught Attack ✅. TN = No threat, no alarm ✅."

→ Why the correct answer is right:

When backup data is stored off-site or in the cloud, it travels over networks and rests in storage outside your direct control. Encrypting backups ensures that even if the media is stolen, intercepted, or the cloud provider is breached, the data remains completely unreadable without the decryption key. It's the last line of defense for backup confidentiality.

→ Why the other options are wrong:

Option A: Frequency of Backups: Determines how much data could be lost (RPO) — about availability and recovery, not security from unauthorized access.

Option C: Snapshots: Capture point-in-time states quickly but don't inherently secure the data content from unauthorized access.

Option D: Journaling: Tracks file system changes for data integrity and crash recovery — not for protecting backup confidentiality.

Exam Tip 🧠

"Off-site backup = Out of your control = ENCRYPT IT! Even if stolen — useless without the key. Always encrypt backups leaving the building!"

→ Why the correct answer is right:

If all data centers are in the same region, a single natural disaster (earthquake, hurricane, flood) could take them all offline simultaneously. Geographic diversification — placing data centers across different regions — ensures that a disaster affecting one area leaves others operational. This is the core of geo-redundancy in disaster recovery.

→ Why the other options are wrong:

Option B: Redundant Power Supply: Protects against local power failures — not regional disasters that physically destroy facilities.

Option C: Fire Suppression Systems: Protects the individual building from fire — useless against a flood or earthquake affecting all co-located centers.

Option D: UPS: Provides short-term power backup — cannot protect against a data center being physically destroyed by a natural disaster.

Exam Tip 🧠

"DR = Spread the risk GEOGRAPHICALLY. Don't put all data centers in one fault line! Geo-diversity = Regional disaster resilience!"

→ Why the correct answer is right:

Before DLP rules can be written, the system must know what it's protecting. Data classification organizes data into categories (PII, financial, confidential, public) based on sensitivity. Only after classification can you write targeted DLP rules — e.g., "block external transfer of files labeled PII." Without it, all DLP rules are generic and ineffective.

→ Why the other options are wrong:

Option B: Mask the data: Data masking is a protection technique applied after classification — it's a downstream action, not the starting point.

Option C: Implement user access levels: Access control is important but doesn't help DLP differentiate between data types for targeted rule application.

Option D: Update security protocols: A general security hygiene task — not specific to enabling targeted DLP rule application.

Exam Tip 🧠

"DLP First Step = CLASSIFY! Can't protect what you haven't labeled. Classify first → Write targeted rules second → Protect everything!"

→ Why the correct answer is right:

Regulated Data is the classification for data subject to specific legal and regulatory requirements. GDPR imposes strict rules on how personal data is collected, stored, processed, and deleted — organizations are legally bound to comply. The label "Regulated" signals that external mandates (not just internal policy) govern this data.

→ Why the other options are wrong:

Option A: Public: GDPR specifically protects personal data from public disclosure without consent — the complete opposite of public classification.

Option B: Restricted: While GDPR data is restricted in access, "Restricted" is a generic internal label that doesn't capture the legal compliance dimension of GDPR.

Option D: Internal Use Only: This is an organizational access policy classification — it doesn't reflect the external regulatory obligations GDPR imposes.

Exam Tip 🧠

"GDPR = Government REGULATION = Regulated Data! It's governed by law, not just company rules. Non-compliance = Heavy fines!"

→ Why the correct answer is right:

AES and DES both use a single shared key for encryption and decryption, making them purely symmetric ciphers.

→ Why the other options are wrong:

Option B: RSA and ECC are asymmetric algorithms that use public and private key pairs.

Option C: DH is used for asymmetric key exchange, and RSA is also asymmetric, not symmetric.

Option D: SHA-256 and MD5 are hash functions, not encryption algorithms at all.

Exam Tip 🧠

AES & DES = Symmetric Siblings

→ Why the correct answer is right:

PAM limits standing administrative access, directly reducing the risk that privileged accounts are abused or compromised.

→ Why the other options are wrong:

Option A: Network intrusion is addressed more by firewalls and IDS/IPS than by PAM specifically.

Option B: Data leakage prevention involves broader controls beyond privilege management alone.

Option D: Phishing is a social engineering threat that PAM doesn't directly target.

Exam Tip 🧠

PAM = Prevents Privilege Abuse

→ Why the correct answer is right:

Just-In-Time permissions grant elevated access only when needed and automatically revoke it afterward, limiting exposure from standing privileges.

→ Why the other options are wrong:

Option B: Permanent administrative rights keep elevated access always on, the opposite of the PAM goal.

Option C: Continuous monitoring tracks activity but doesn't grant or revoke privileges itself.

Option D: Static group membership implies fixed, unchanging access levels, not dynamic elevation.

Exam Tip 🧠

PAM = Just-In-Time, Not Just-Always

→ Why the correct answer is right:

Dynamic KBA uses real-time data, like recent transactions, to generate questions that are hard for attackers to predict or research in advance.

→ Why the other options are wrong:

Option A: Static KBA relies on predefined questions set up in advance, not real-time transaction data.

Option C: Biometric authentication uses physical traits, not knowledge-based questions.

Option D: MFA combines multiple factor types generally, but this scenario specifically describes one KBA method.

Exam Tip 🧠

Dynamic KBA = Real-Time Data Questions

→ Why the correct answer is right:

Temporal accounts are created for a specific task and time frame, then automatically expire, reducing the risk of long-standing privileged access.

→ Why the other options are wrong:

Option A: Permanent role-based access assigns fixed, ongoing roles rather than expiring accounts.

Option B: Just-in-time permissions grant temporary rights but don't specifically describe creating and deleting whole accounts.

Option D: Continuous monitoring watches access activity but doesn't itself create or expire accounts.

Exam Tip 🧠

Temporal Accounts = Built to Expire

→ Why the correct answer is right:

A UTM bundles firewall, antivirus, web filtering, and intrusion prevention into one centrally managed platform, simplifying administration.

→ Why the other options are wrong:

Option A: SIEM collects and analyzes security data but doesn't actively block threats like a UTM does.

Option C: NIPS focuses only on intrusion prevention, lacking the broader combined feature set of a UTM.

Option D: A Web Security Gateway only covers web filtering, not the full suite UTM provides.

Exam Tip 🧠

UTM = All-in-One Security Bundle

→ Why the correct answer is right:

ARO estimates how many times an event is expected to occur in a year, making it ideal for forecasting incident frequency trends.

→ Why the other options are wrong:

Option A: ALE calculates yearly financial loss expectancy, not the count of incidents.

Option C: MTBF measures system reliability between failures, not security incident frequency.

Option D: SLE estimates the cost of a single loss event, not how often incidents will occur.

Exam Tip 🧠

ARO = Annual Rate of Occurrence

→ Why the correct answer is right:

An HSM is a dedicated, tamper-resistant device built specifically for generating, storing, and managing cryptographic keys at scale.

→ Why the other options are wrong:

Option A: A TPM is a chip built into a device for hardware-level security, but it's not the dedicated key-management appliance described here.

Option C: Key Management Systems are usually software-based and lack the same physical tamper resistance as an HSM.

Option D: A Secure Enclave protects sensitive data on a device but isn't primarily focused on enterprise key management.

Exam Tip 🧠

HSM = Hardware Home for Your Keys

→ Why the correct answer is right:

Salting adds a unique random value to each password before hashing, so identical passwords still produce different stored hashes.

→ Why the other options are wrong:

Option B: Password aging just forces periodic changes; it doesn't affect how hashes are generated.

Option C: A hash collision is when different inputs produce the same hash, the opposite of what's happening here.

Option D: A dictionary attack is a cracking method, not an explanation for differing hash values.

Exam Tip 🧠

Salting = Same Password, Different Hash